Log in

View Full Version : Reversing C++

Vuurvlieg
January 15th, 2008, 03:37
Hello,
I am reversing a target and partly trying to reconstruct some classes to be able to interact and use functions in the target.
The problem I got is that I just can't seem to get the memory layout of it right.
I will use one class as an example.
First of all, all the classes in this target inherit the same "baseclass" that looks very similar to the windows IUnknown interface. It is an abstract class that only has 3 virtual functions:
Code:


class IClass

{

public:

virtual void AddRef( void ) = 0;

virtual void Release( void ) = 0;

virtual PVOID QueryInterface( unsigned int IID ) = 0;

}


Now about the class I am trying to reconstruct, it is not one class but a few classes that inherit each other (or so it seems).
There is this abstract class lets call it 'CTemplate';
If I look at the constructor of the class:
Code:


.text:081D4605                 mov     dword ptr [ebx], 8724CA8h

.text:081D460B                 mov     dword ptr [ebx+4], 8724D08h

There they move 2 vtables at class+0x0 and class+0x04.
If we look at the vtable's in memory:
Code:


//vtable1

.data:08724CA8                 dd offset __cxa_pure_virtual

.data:08724CAC                 dd offset __cxa_pure_virtual

.data:08724CB0                 dd offset __cxa_pure_virtual

.data:08724CB4                 dd offset ctemplate_vfunction1

.data:08724CB8                 dd offset ctemplate_vfunction2

.data:08724CBC                 dd offset ctemplate_vfunction3

..... more funcs



//vtable2

.data:08724D08                 dd offset __cxa_pure_virtual

.data:08724D0C                 dd offset __cxa_pure_virtual

.data:08724D10                 dd offset __cxa_pure_virtual

.data:08724D14                 dd offset ctemplate_vt2_vfunction1

So some virtual functions members being 'pure' proofs that were dealing with another abstract class.
Now actually here already comes the first problem I came across.
As I showed above it has 2 vtables, one at 0x0 and one at 0x4.
I know that from both these vtables the first 3 virtuals funcs are those from what I called IClass. I got proof for that which I will explain later (likely in another post after I got my first problem figured out).
How is this supposed to look in a high level language?
Because I wanna check out the memory layout I just make the virtual functions do something simple.
Code:


class CTemplate : public IClass

{

public:

//no implentation for the IClass funcs here, they are still pure.

	virtual	void	function1( void ){ a = (a+1)<<1; }

	virtual void	function2( void ){ b = (b+1)<<1; }

	virtual void	function3( void ){ c = (c+1)<<1; }



	CTemplate( )

	{

		a = b = c = 1;

	}



	int a;

	int b;

	int c;

};

As you can see in the code above I got no code for the second vtable, my first question to you guys: how can I add something in the above define to make it generate a vtable at 0x4 with also the IClass as baseclass?

(You can do 2 things to be able to see the memory layout:
- quickly create another class that inherits the CTemplate but has no pure functions thus you can create an instance of it and check it in a debugger.
- use an undocumented compiler flag; (add the option "/d1 reportAllClassLayout" to project_settings->C/C++->CommandLine )

I have been trying to figure this out for days but I don't have enough experience with classes. I did found some interesting article on the path of me seeking for answers.
https://www.blackhat.com/presentations/bh-dc-07/Sabanal_Yason/Paper/bh-dc-07-Sabanal_Yason-WP.pdf ("https://www.blackhat.com/presentations/bh-dc-07/Sabanal_Yason/Paper/bh-dc-07-Sabanal_Yason-WP.pdf")
All input is welcome.
xtc
January 15th, 2008, 14:02
See http://en.wikipedia.org/wiki/Virtual_table ("http://en.wikipedia.org/wiki/Virtual_table")

That it's using two vftables suggests that CTemplate is inheriting from two base classes, ie. class CTemplate : public Base1, public Base2.
The two base classes may be inheriting from IClass, however that can't be determined solely from the pure virtual entries.
However, supposing that they do, then Base2 provides one extra virtual function in it's table.
Any virtual functions of CTemplate are appended to the vftable of Base1 so the entries beyond IClass may come either from Base1, CTemplate or both.

So, it might look like this:
Code:
class Base1 : public IClass {

public:

    virtual void Function1a();

    virtual void Function1b();

};

class Base2 : public IClass {

public:

    virtual void Function2a();

};

class CTemplate : public Base1, public Base2 {

public:

    virtual void Function3a();

};
Vuurvlieg
January 15th, 2008, 16:23
Hey thanks a lot, that is really an eye opener! I had already read that stuff on wikipedia but somehow your example dropped the quarter for me.
Still there is some annoyance I have with this though because to be able to make the compiler place a new vtable I need to inherit 2 classes.
Now what if the memory looked something like this
+0x00 vtable
+0x04 vtable
+0x08 member data...
+0x0C member data...
+0x10 member data...
+0x14 member data...
+0x18 vtable

now as you can see there is a vtable at 0x18, to be able to get the correct layout I have to make up 'middle-man' class just so I can generate the vtable at 0x18. example:

Code:


class CSomeclassmiddleman : public IClass

{

public:

virtual void function1( void ) = 0;

virtual void function2( void ) = 0;

}



//this is the actual class we wanted the vtable at 0x18 generated for but since its required to inherit at least two I need that middleman

class CSomeclass : public CTemplate, public CSomeclassmiddleman

{

public:

virtual void function1( void ) { ... }

virtual void function2( void ) { ... }



//members

}


So my question here is, is there a way to loose the middleman ?
reverser
January 16th, 2008, 21:09
It's not clear without looking at the code but it's possible that at 0x18 you actually have a member variable and not a base class. E.g.
Code:


class CTemplate : public Base1, public Base2 {

public:

    virtual void Function3a();

    int member08;

    int member0C;

    int member10;

    int member14;

    SomeClass3 member18;

};

where SomeClass3 has some virtual methods.

BTW, check out the original article that IBM guys based their research on.
https://www.openrce.org/articles/full_view/23
See also links at the end.